Armed Guards

I had an interesting email conversation with a reader last week about the issue of armed guards at high-risk chemical facilities. The reader wanted to know my opinion about whether or not DHS would ‘require’ the use of armed guards for Tier 1 or 2 facilities. I did a series of postings on the subject over a year ago, but that was before the Risk Based Performance Standards Guidance document was published. Perhaps it is time to revisit the issue. 

Of course, DHS cannot ‘require’ any security measure in the approval of the facility’s Site Security Plan. This is specifically prohibited by the §550 authorization for the CFATS regulations. The real question is under what circumstances would DHS expect to see the use of armed guards to adequately address the Deter, Detect and Delay performance standard? 

Armed Guards and the Guidance Document 

The discussion portion of RBPS #4 in the Guidance document has very little to say about security guards. The single paragraph discussing armed guards (pg 53) states that:

“Protective forces are often used to enhance perimeter security and provide a means of deterrence, detection, delay, and response. Such forces can be proprietary or contracted and can be armed or unarmed. They may be qualified to interdict adversaries themselves or simply to deter and detect suspicious activities and to then call local law enforcement to provide an interdiction.”

Even in the metric portion of the Guidance document there is only a very limited discussion of security forces. Metric 4.1, Deterrence and Delay (General), briefly addresses ‘on-site security’ (pg 55) by stating, for Tier 1 facilities:

“Through a combination of on-site security, barriers and barricades, hardened targets, and well-coordinated security response planning, the facility has a very high likelihood of deterring an attack and/or delaying an attack for a sufficient period of time to allow appropriate security response.”

Other brief mentions of the use of security forces can be found in RBPS #1 and #2 where they describe such forces as ‘standing posts at critical assets’, ‘using remote surveillance’, or ‘conducting roving patrols’. No mention is made of the employment of armed personnel. Metric 3.1 mentions that access control points are manned by ‘security personnel’, but there is no discussion of whether or not they might be armed personnel. 

As one would expect, the SSP Questions Manual does not give much in the way of guidance. There are a number of questions listed about security forces (see pages 148 thru 152), including questions about what whether they are armed (for example: Q:10.33-15459, pg 149). None of these questions provides any hint of what DHS would like to see. There are a number of questions, however, in the facility information portion of the SSP about response capabilities, both on-site and off. On-site response questions include asking if the facility has snipers or ‘tactical response (combat)’ teams (pg 30). The off-site response questions are much more extensive and include questions about the local police force capabilities as well as their response time. The response time questions (pg 31) address both initial response (first officer on scene) and ‘tactical response’ times. 

Determining Need for Armed Guards 

Lacking specific guidance from DHS on when and where armed guards are ‘required’, how does a facility make the determination whether or not they need armed guards? To answer that we need to go back and look at the RBPS 4.1 Metric; for tier 1 facilities the need is for a security system that is capable of “delaying an attack for a sufficient period of time to allow appropriate security response”. 

First we need to understand what an ‘appropriate security response’ is. In large part this will depend on the COI at the facility. For Theft/Diversion COI an appropriate response may be the apprehension of the terrorists with the COI in their possession before they have a chance to employ them in a subsequent attack. For facilities with a large quantity of Release Toxic COI, an appropriate response would have to be one capable of stopping a successful release of that COI into the surrounding community. That response must be capable of stopping a determined and likely armed attack on the facility; this requires an armed response force. 

The next question the facility must answer is whether or not they are going to rely on on-site or off-site response forces for their ‘appropriate response’. If an off-site response force is going to be used for the final line of defense, the on-site security system (including security force) is going to have to be able to delay an attacker until that response force can arrive on scene, apprise themselves of the situation and assume a tactical position that maximizes the potential success of their mission. How much time that will be will vary according to the situation, but it can be determined with the gaming of a number of likely attack scenarios. 

Once the appropriate response time is determined, the facility simply needs to determine if their security devices, procedures and personnel are capable of delaying a determined attack for that length of time. The best way to determine this is to have tactically experienced personnel conduct a penetration exercise. Lacking that an evaluation by an independent security team not connected with the installation or maintenance of the security systems should be conducted. 

The bottom line is that if a toxic release COI is present in large enough volumes to present a threat to a relatively large off-site population, an armed response is going to be necessary to prevent a terrorist attack aimed at that COI. If the response force is on-site, it must be armed. If the response force is off-site, it may be necessary to have an on-site security force that is armed to delay the potential attack long enough for the response force to arrive and defeat the attackers.